A large security program was funded two years ago on the basis of expected risk reduction, but no one has checked whether the promised benefits were delivered. What should the security manager do?
Select an answer to reveal the explanation.
Short Explanation
Getting the money is only half the deal; showing it paid off is the other half. You compare what the business case promised with what actually happened and report it to the people who funded it. The trap is reporting milestones or spending, which tell you the work got done, not that it worked.
Full Explanation
Benefits realization closes the loop between investment and value. A business case sets expectations, for example reductions in specific risks, improved resilience or enabled business initiatives, and once funding is granted those expectations should be tracked through measures defined in advance and reported to sponsors. This allows management to confirm the investment delivered value, make corrective decisions if benefits lag and build credibility for future requests. Requesting further funding on the basis of original projections ignores two years of evidence and asks sponsors to trust assumptions that should already have been tested. Reporting milestones delivered on schedule demonstrates project execution, which matters, but delivering activities on time does not prove that the intended risk reduction or business outcome occurred. An external audit of spending against budget addresses financial control and stewardship, a valid concern, yet it does not assess whether the promised benefits materialized. Exam caveat: some benefits, such as avoided incidents, are hard to measure directly, so proxies like changes in risk ratings, control effectiveness or exposure metrics are acceptable when agreed in advance. Operational check: define benefit measures for each objective in the business case, record baselines and current values, and present them at sponsor reviews.